Vulnerabilities
AhsayCBS Chained Flaws Enable Crypto Miners on MSP Servers Despite Vendor Fixes
Threat actors chain two unpatched flaws in AhsayCBS to bypass login checks and install cryptocurrency miners on MSP servers.
Vulnerabilities
Vulnerabilities
Metasploit Framework Auth Bypass CVE-2026-87689 Lets Unauthenticated Users Delete Credentials
A critical flaw in Metasploit Framework allows anyone with network access to read or delete stored credentials without logging in.
Vulnerabilities
Netherman Portal Critical Flaw Lets Hackers Seize Accounts via Reset Loophole
A severe authentication flaw in Netherman Portal del Hermano allows unauthenticated users to hijack accounts by exploiting error messages and missing limits.
Vulnerabilities
Privasys ra-tls-clients Identity Check Flaw Patched in 0.11.0 to Stop Endpoint Impersonation
A flaw in older versions allowed attackers to impersonate secure endpoints by bypassing platform identity checks. Version 0.11.0 resolves this critical risk.
Vulnerabilities
MarkLogic Server 12.1.0, 11.3.7 Patch Critical Backup Privilege Escalation CVE-2026-85956
A critical bug in older MarkLogic versions allows remote attackers with admin rights to back up or restore data beyond their authorised limits.
Vulnerabilities
SonicWall SMA1000 SSRF Flaw CVE-2026-102255 See Wild Exploitation
Attackers target patched SonicWall SMA1000 appliances using a maximum-severity server-side request forgery flaw within days of disclosure.
Vulnerabilities
Discourse image upload flaws chain race condition and Ghostscript for file access
Basic users could read server files via a complex exploit chain, while anonymous visitors faced cache poisoning risks in the forum software.
Vulnerabilities
Unauthenticated SQL Injection in Stylemix uListing 2.2.0 Demands Immediate Attention
A critical vulnerability in the Stylemix uListing plugin allows remote attackers to exploit SQL injection flaws without authentication.
Vulnerabilities
Data Leak: FBI Arrests CyberSteward Exec Edward Dubrovsky Linked to ShinyHunters Theft of Agent Records
Authorities arrested a Canadian executive linked to ShinyHunters after the group stole sensitive records of thousands of federal law enforcement agents.
Vulnerabilities
PaperCut MF: Four Flaws Allow Unauthenticated Remote Code Execution, Complicating Patching
Researcher discloses a series of flaws allowing attackers to take control of PaperCut systems without login credentials, complicating patching efforts.
Vulnerabilities
openapi-typescript-codegen CVSS 9.3 Vulnerability Enables JS Injection via OpenAPI Documents
A critical vulnerability in openapi-typescript-codegen enables attackers to inject malicious JavaScript via manipulated OpenAPI documents, affecting versions up to 0.31.0.
Vulnerabilities
Sergey AIWU CWE-266 Critical Flaw: 9.8 CVSS Risk for Subs Up to v1.5.9
A critical flaw allows subscribers to escalate privileges in Sergey AIWU versions up to 1.5.9, rated 9.8 by the US National Vulnerability Database.
Vulnerabilities
Blocksy Companion Plugin Allows Unauthenticated Users to Claim Seller Roles via Privilege Escalation
A critical flaw in the Blocksy Companion WordPress plugin enables unauthenticated attackers to bypass security checks and assume vendor roles, even when registration is disabled.
Vulnerabilities
OSS Scanner: Anthropic's AI finds open-source flaws, auto-reports without human checks
Anthropic has launched a free, opt-in security tool that sends automated vulnerability reports for open-source projects, bypassing traditional human review.
Vulnerabilities
Privasys RA-TLS Fixes Enclave Session-Binding Bypass in Rust and Go
Security update fixes CVE-2026-108269 in Rust and Go clients, stopping attackers from spoofing enclave connections via relay attacks.
Vulnerabilities
Travesia WordPress Object Injection Flaw in Versions Up to 1.1.16 Poses Severe Risk to Administrators
A critical object injection flaw in the Travesia WordPress theme affects versions up to 1.1.16, posing severe risks to site administrators.
Vulnerabilities
Browser Update Checklist for Secure Endpoint Management
Delayed browser updates expose systems to silent data exfiltration through compromised extensions rather than just drive-by malware downloads.
Vulnerabilities
How Content Security Policy Blocks Attacks in the Browser
Content Security Policy stops scripts from running by default, forcing you to explicitly allow only the specific sources your application actually needs to function.
Vulnerabilities
Prototype Pollution Myths: Why Standard Defences Fail
Prototype pollution alters object behaviour at runtime, bypassing static checks and standard input validation without triggering typical injection alerts.
Vulnerabilities
Hard-Coded Credentials: How Embedded Secrets Compromise Software Security
Hard-coded credentials bypass runtime security controls by embedding access rights directly into the application code, rendering encryption and network segmentation ineffective against static analysis.
Vulnerabilities
Detect File Upload Vulnerabilities: Log Signals and Blind Spots
Malicious uploads often bypass initial checks by hiding in metadata or exploiting race conditions, leaving traces in access logs rather than alert systems.
Vulnerabilities
Software Bill of Materials: Definition, Purpose and Practical Use
An SBOM exposes hidden supply chain risks by listing every component in your software, revealing vulnerabilities that traditional scanning misses.
Vulnerabilities
NoSQL Injection Risks and Protection for Small Businesses
Many small teams assume document databases are immune to SQL-style attacks, yet the flexible query syntax often bypasses standard input validation entirely.
Vulnerabilities
Vulnerability scanning explained: find flaws before attackers do
Automated scans miss logic errors that only human reasoning can detect, meaning you need a different approach for certain critical flaws.